#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

unsigned long long write_in_libc = 0x1111d0;
unsigned long long main_arena_in_libc = 0x1ebb80;

int main(int argc, char * argv[]) {	
	setbuf(stdout, NULL);
	
	unsigned long long libc_from_write = 0;
	unsigned long long libc_from_main_arena = 0;
	unsigned long long main_arena_leak = 0;
	
	libc_from_write = (unsigned long long)write - write_in_libc;
	main_arena_leak = (unsigned long long)write - write_in_libc + main_arena_in_libc;
	printf("write, libc, main_arena: %p, %p, %p\n", write, (void*)libc_from_write, (void*)main_arena_leak);

	unsigned long long u = 0;
	unsigned long long * t[7] = {0};
	for (int i=0; i<7; i++) {
		t[i] = (unsigned long long *)malloc(0xf0);
	}
	unsigned long long * a = (unsigned long long *)malloc(0xf0);
	unsigned long long * b = (unsigned long long *)malloc(0xf0);
	for (int i=0; i<7; i++) {
		free(t[i]);
	}
	free(a);

	u = a[1];
	printf("%016llx %016llx %016llx %016llx\n", a[0], a[1], a[2], a[3]);
	if(main_arena_leak == u - 0x60) {
		printf("success!\n");
	} else {
		printf("failed!\n");
	}
	
	free(b);
	
	return 0;
}
